Subject: [nfsv4] allowing certain Ops to use AUTH_NONE or AUTH_SYS

From: Rick Macklem <[email-masked]>
Date: Wed, 23 May 2007 11:54:37 -0400 (EDT)

While doing some server cleanup, I've run across this:
RFC2623 suggests that servers allow certain RPCs (FSINFO for v3) to be
performed using AUTH_NONE or AUTH_SYS so that clients can perform mounts
without having valid RPCSEC_GSS credentials. (It does note this opens up
certain vulnerabilities to attack.)

So, I was wondering what others feel about allowing NFSv4 Compounds with
certain Ops in them (PUTROOTFH, LOOKUP, GETFH + ???) to be done using AUTH_NONE
or AUTH_SYS, so that clients can set up NFSv4 mounts without having
valid RPCSEC_GSS credentials? (ie. For clients that don't have machine
credentials in a keytab, as an example.)

RFC3530 doesn't seem to say anything specific on this.

rick

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4